feat(deploy): Dockerfile + Compose for self-hosted apps

Closes #36

Summary Adds a practical self-host path for Everything apps so operators are not limited to Amplify or per-folder npm run dev. Refs #36. ## What’s included - deploy/Dockerfile — Node 22 build → nginxinc/nginx-unprivileged on :8080, HEALTHCHECK, non-root - deploy/nginx/app.conf — HTML / sw.js / manifest.json / worker/ no-cache; /assets/* immutable; .wasm → application/wasm - deploy/nginx/profiles/chess.inc — CSP + security headers matching src/chess/customHttp.yml - docker-compose.yml — reference services: documents :8081, spreadsheet :8082, chess :8083, parametric :8084 - .dockerignore + deploy/README.md + root README “Self-hosting” section ## Validation docker compose build chess docker compose up -d chess curl -sI http://localhost:8083/ # Cache-Control: no-cache… + CSP # asset JS: Cache-Control: public, max-age=31536000, immutable + CSP ## Limitations (documented) - One port per app (Vite absolute /assets/ paths) - Cloudflare Workers not run by Compose - Puter SDK still uses public Puter origins unless apps are changed ## Summary Adds a practical self-host path for Everything apps so operators are not limited to Amplify or per-folder npm run dev. Refs #36. ## What’s included - deploy/Dockerfile — Node 22 build → nginxinc/nginx-unprivileged on :8080, HEALTHCHECK, non-root - deploy/nginx/app.conf — HTML / sw.js / manifest.json / worker/ no-cache; /assets/* immutable; .wasm → application/wasm - deploy/nginx/profiles/chess.inc — CSP + security headers matching src/chess/customHttp.yml - docker-compose.yml — reference services: documents :8081, spreadsheet :8082, chess :8083, parametric :8084 - .dockerignore + deploy/README.md + root README “Self-hosting” section ## Validation docker compose build chess docker compose up -d chess curl -sI http://localhost:8083/ # Cache-Control: no-cache… + CSP # asset JS: Cache-Control: public, max-age=31536000, immutable + CSP ## Limitations (documented) - One port per app (Vite absolute /assets/ paths) - Cloudflare Workers not run by Compose - Puter SDK still uses public Puter origins unless apps are changed